How do I check to see if my computer is infected with the OSX/Crisis Trojan?
Just recently, a new trojan for OS X was discovered. Apparently it only affects Snow Leopard and Lion. Whether it does/doesn't affect Mountain Lion is still unknown. The trojan sits on your computer and hides, doing nothing so far. How do I check to see if this trojan has been installed on my system? If it is, how do I remove it?
Apparently, Intego has been investigating this trojan and has found that the trojan will only be on your machine if the following folder exists:
/Library/ScriptingAdditions/appleHID/
If it was installed with admin privileges, this files/folders will exist:
/System/Library/Frameworks/Foundation.framework/XPCServices/
/System/Library/Frameworks/Foundation.framework/XPCServices/com.apple.mdworker_server.xpc/Contents/MacOS/com.apple.mdworker_server
/System/Library/Frameworks/Foundation.framework/XPCServices/com.apple.mdworker_server.xpc/Contents/Resources/
/Library/ScriptingAdditions/appleHID/Contents/Resources/appleOsax.r
These files ping the IP address 176.58.100.37 every 5 minutes. It currently doesn't do anything, but at any point the trojan could activate and potentially cause problems. Intego also reports that Mountain Lion is not affected by the trojan. Intego's VirusBarrier will remove the trojan.